2 ms·

It depends on what they consider "collecting information". Does your server log IP addresses? Do you know the age of the person behind each IP address? Does tha

by imgabe 5y ago

It depends on what they consider "collecting information". Does your server log IP addresses? Do you know the age of the person behind each IP address? Does that count as "collecting information" about them? You know an IP, the time and date they accessed the site, what pages they viewed, you can infer a general location. If the law is not clear enough, it can be interpreted to make basically any website infringing. If you want to have a newsletter, or offer a service where people log in and want to recover their password, you'll need at least an email address. Can you verify that every email address is exclusively used by people 13+?

mark_l_watson 5y ago
I agree with the grandparent poster that not collecting information should be the default. re: collecting IP addresses: I run my web sites behind Nginx and does have rolling logs, but I ignore IP addresses. For your e-mail use case, I think a reasonable compromise is asking if the user is older than 13 and what alternative is there but to trust them? Personally, I think that collecting e-mail addresses for people signing up for a newsletter is a great example of when it is perfectly fine to collect private data.
svachalek 5y ago
I think duration and consent have to be part of the equation. Collecting an IP for somewhere in the range of milliseconds to 24 hours in order to gather statistics about site traffic is one thing, putting it in perpetual storage for cross correlation is entire different. Asking for an email address to create an account is one thing, using 3rd party cookies to figure out someone’s email address to cross correlate with their browsing history is different. Blurring the line between these innocent practices and mass surveillance by international corporations is quite disingenuous.
- imgabe 5y ago
  I am not trying to blur the line or say they’re equivalent. I’m saying that if the law, as written, doesn’t distinguish between these things then it becomes a cudgel that can be selectively wielded against any website that happens to draw the ire of anyone with power to launch investigations. We all see how incompetent the government is when it comes to understanding technology and how it works (see the Missouri governor clamoring to prosecute someone for “hacking” because they used view source), so remember when you’re asking for greater regulation who it is that’s going to be doing the regulating.

by imgabe 5y ago

mark_l_watson 5y ago

I agree with the grandparent poster that not collecting information should be the default. re: collecting IP addresses: I run my web sites behind Nginx and does have rolling logs, but I ignore IP addresses. For your e-mail use case, I think a reasonable compromise is asking if the user is older than 13 and what alternative is there but to trust them? Personally, I think that collecting e-mail addresses for people signing up for a newsletter is a great example of when it is perfectly fine to collect private data.

svachalek 5y ago

I think duration and consent have to be part of the equation. Collecting an IP for somewhere in the range of milliseconds to 24 hours in order to gather statistics about site traffic is one thing, putting it in perpetual storage for cross correlation is entire different. Asking for an email address to create an account is one thing, using 3rd party cookies to figure out someone’s email address to cross correlate with their browsing history is different. Blurring the line between these innocent practices and mass surveillance by international corporations is quite disingenuous.

imgabe 5y ago
I am not trying to blur the line or say they’re equivalent. I’m saying that if the law, as written, doesn’t distinguish between these things then it becomes a cudgel that can be selectively wielded against any website that happens to draw the ire of anyone with power to launch investigations. We all see how incompetent the government is when it comes to understanding technology and how it works (see the Missouri governor clamoring to prosecute someone for “hacking” because they used view source), so remember when you’re asking for greater regulation who it is that’s going to be doing the regulating.